live discovery query for: web browsing activity of MAC device

Question

Hi, 
 
 Please let us know if there is a sql query for get all web browsing activity of user/ computer for MAC devices on sophos central. 
 I found we have inbuilt query available for Windows as : "URLs accessed on Windows (Data Lake)". 
 
 Kindly let us know if there is an option on endpoint protection or any sophos products to get this report

Qoosh · Accepted Answer

Hi Hemanth , 
 Thanks for reaching out to the Sophos Community Forum. 
 It looks like the data collected currently from macOS devices will not be sufficient to query the full browsing history on these devices. You can find more details on what information is collected and stored in the Data Lake on the following page. - Sophos Schema 
 To see specifically what data is accessible via queries, select the drop-down next to "Endpoint" and specify "Mac". This will take you to the osquery schema page. - osquery Schema 
 You may be able to get the data you're looking for if you have a Sophos Firewall deployed at the site where the concerned devices are present, but it does not look like this is currently possible with XDR on MacOS.

live discovery query for: web browsing activity of MAC device

Top Replies